---
id: "CVE-2021-32822"
kind: "vulnerability"
aliases: ["CVE-2021-32822", "GHSA-7f5c-rpf4-86p8"]
title: "hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor"
severity: "medium"
cvss: 5.3
epss: 0.01131
exploited: false
status: "open"
category: "package"
products: [{"name": "hbs", "fixed": [], "affected": "<= 4.4.0", "ecosystem": "npm"}, {"name": "hbs project hbs", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-200", "cwe-538", "cwe-94", "express", "handlebars", "hbs", "node", "package", "self-hosted"]
not_affected_if: ["fixed-template-data", "no-hbs"]
published_at: "2021-08-16T19:15:14+00:00"
first_seen_at: "2026-10-27T16:10:07+00:00"
updated_at: "2026-10-27T16:33:08+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7f5c-rpf4-86p8", "first_seen_at": "2026-10-27T16:10:07+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32822", "first_seen_at": "2026-10-27T16:33:08+00:00"}]
---

# hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor

The npm hbs package, an Express view engine for Handlebars, mixes template data with engine configuration passed through the Express render API. An attacker who controls data passed to render can overwrite internal options and trigger reading of arbitrary files from the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:hbs affected <= 4.4.0 fixed ?
- vendor:hbs project hbs affected ? fixed ?

## How to check

- Run `npm ls hbs` in the project to see whether hbs is installed and which version resolves.
- Search application code for calls to `res.render` or `app.render` that pass user-controlled objects straight into template data.

## Timeline

- 2026-10-27T16:10:07+00:00 ghsa https://github.com/advisories/GHSA-7f5c-rpf4-86p8
- 2026-10-27T16:33:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-32822

## From the sources

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_